Lion Cipher Lab
Write a threat-intel report people actually use: BLUF, confidence, and estimative language
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Collection and analysis are worthless if the finished product doesn't get read, understood, and acted on. The reporting-and-dissemination step is where most junior analysts lose their audience: they bury the answer, hedge every sentence, dump a wall of indicators with no context, or confuse how-likely-something-is with how-sure-they-are. Worse, they mislabel who is allowed to see it and either leak sensitive intel or sit on something that should have been shared. This lab teaches the tradecraft that separates a report a CISO forwards and acts on from one that dies in an inbox: lead with the…
What you'll learn
- writing a finished CTI product
- BLUF and Key Judgments structure
- estimative (likelihood) language
- analytic confidence levels
- keeping likelihood separate from confidence
- ICD 203 analytic standards
- source grading (Admiralty code)
- mapping behavior to MITRE ATT&CK
- Traffic Light Protocol (TLP 2.0) handling markings
- disseminating intelligence responsibly
Steps in this lab
- What a finished intelligence product actually is
- The scenario you'll write up
- Structure: BLUF, Key Judgments, body, indicators-with-context, recommendations
- The analytic standards you're being held to (ICD 203)
- Uncertainty done right: likelihood and confidence are TWO different things
- Grade your sources so the reader can weigh them
- Make it actionable: map behavior to MITRE ATT&CK
- Mark it so it can actually be shared: TLP 2.0
- A nod to machine-readable dissemination (STIX)
- Write the one-page report (your deliverable)
- Self-review, and when a two-line flash beats a full report